PT-2019-10962 · Imperva · Imperva Securesphere

Published 2019-01-10 · Updated 2019-10-09 · CVE-2018-5403

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Imperva SecureSphere gateway version 13

Description: The issue allows for remote code execution (RCE) through specially crafted requests from the web access management interface, given that the attacker has knowledge of the basic authentication passwords. This can be exploited regardless of whether it's before or after the First Time Login (FTL).

Recommendations: For version 13, consider restricting access to the web access management interface until a fix is available, and ensure that basic authentication passwords are securely managed to minimize the risk of exploitation.

Exploit

Fix

RCE

Command Injection

Improper Authentication

Weakness Enumeration

CWE-77

CWE-287

Related Identifiers

CVE-2018-5403

Affected Products

Imperva Securesphere

References · 3

• 🔥 https://exploit-db.com/exploits/45542 · Exploit
• https://osv.dev/vulnerability/CVE-2018-5403 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5403 · Security Note